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Abstract. Low-latency anonymity networks like Tor are subject to selective denial- 
of-service (DoS) attack. Selective-DoS attack lowers anonymity as it forces paths 
to be rebuilt multiple times to ensure delivery which increases the opportunity for 
more attack. In this paper we present a detection algorithm which filters out com- 
j.-^ ■ promised tunnels from a set of Tor tunnels to ensure better anonymity. Our de- 

^si ■ tection algorithm uses two levels of probing to filter out potentially compromised 

tunnels. We perform probabilistic analysis and extensive simulation to show the 
robustness of our detection algorithm. We also analyze the cost of our algorithm 
and show a tradeoff between security and communication overhead. Real world 
experiments reveal that our detection algorithm provides good defense against 
selective-DoS attack. 
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^ \ 1 Introduction 

Tor [11] is a low-latency anonymity network which conceals users' identities and activ- 
fvq . ities from surveillance and traffic analysis. Tor provides confidentiality and privacy to 

^ ■ users of various types ranging from ordinary individuals to business men, journalists, 

Cn . government employees and even military personnel. Currently, Tor has over 2500 relays 

all around the world and it provides support to several hundreds of thousands of people 
every day [12, 15]. 

User identity, however, can become exposed when multiple relays are compromised. 
By default. Tor uses three relays and an attacker who can gain control of the entry 
and exit relays is capable of compromising user identity using timing analysis [14, 
19]. Moreover, malicious nodes can perform selective denial of service (DoS) attack 
[7, 8] where compromised relays drop packets until a path starting and ending with a 
compromised node is built. This increases the probability of such a path being built and 
as a result lowers anonymity. So some form of mechanism is needed to ensure secure 
path construction in the presence of compromised relays. 

Danner et al. [9] showed that it is possible to identify relays mounting selective- 
DoS using exhaustive probing. The intent is to periodically carry out these probes 
and blacklist the misbehaving relays; however, the total number of probes required is 
prohibitive — 3 times the total number of relays in the best case, and many more (typi- 
cally retrying each probe 10 times) to account for non-malicious failures. Thus, if large 
number of users were to carry out these probes simultaneously then this would signifi- 
cantly congest the Tor network. 

Our goal is to develop a local approach that can be used by individual Tor users 
to protect themselves from selective-DoS. Like Danner et al., we make use of probing. 



but rather than deterministically identifying all relays that are performing selective- 
DoS, we probabilistically check the safety of particular circuits. In particular, a user 
builds a number of circuits for future use and then evaluates their safety by checking 
whether nodes involved in a circuit will perform a selective-DoS attack. Our tests are 
based on the assumption that only a minority of Tor nodes are compromised; this is 
generally assumed to be necessary to receive reasonable anonymity protection from 
Tor, regardless of selective-DoS attacks. 

We analyzed our detection algorithm using probabilistic models, simulations and 
real world experiments. Our algorithm ensures that an attacker who performs selective- 
DoS is unsuccessful at compromising tunnels with high probability. We also study 
adaptive attackers who change their strategy specifically in response to our detection 
scheme. We find that, depending on the choice of parameters, the dominant strategy 
for such attackers is to either not perform selective-DoS, or to probabilistically perform 
DoS on a small fraction of tunnels, resulting in a nominal benefit. 

2 Background 

In this section, we briefly describe the Tor system architecture and explain how selective- 
DoS attack can lower anonymity in such a system. 

2.1 Tor Network 

Tor [11] is an anonymous communication network that allows users to make TCP con- 
nections to Internet sites without revealing their identity to the destination or third-party 
observers. We will briefly explain the main components of the operation of Tor as they 
are relevant to this work. To initiate an anonymous TCP connection, a Tor user con- 
structs a circuit (also known as a tunnel or path) comprised of several Tor relays (also 
known as routers). The relays form a forwarding chain that sends traffic from the user to 
the destination, and vice versa. Circuits typically involve three relays: the entry, middle, 
and exit. The traffic contents are protected by a layered encryption scheme, called onion 
routing [18], where each relay peels off a layer while forwarding. As a result, any indi- 
vidual router cannot reconstruct the circuit path and link the source to the destination: 
the entry relay knows the source, but not the destination, and the exit relay knows the 
destination, but not the source. The relays in a circuit are chosen using specific con- 
straints [10]. Each user selects a small, fixed number of entry relays that are used for 
all circuits, out of relays that are "fast" (have above-median bandwidth) and "stable" 
(have an uptime of several days). These relays are called guard relays [17, 22]; their 
use is designed to defend from the predecessor attack [23]. To choose the exit relay, 
the user picks from among those relays that have an exit policy — a list of external sites 
and ports that a relay is willing to connect to-compatible with the desired destination. 
After these constraints, the relays for each position are chosen randomly, weighted by 
their bandwidth. (Relays that match the criteria for guard and/or exit are underweighted 
when choosing the middle node to improve the overall balancing of load.) 

Tor aims to provide low-latency traffic forwarding for its users. As a result, as traffic 
is forwarded along the path of a circuit, timing patterns remain discernible, and an 



attacker who observes two different relays can use timing analysis to determine whether 
they are in fact forwarding the same circuit [14, 19, 21, 24]. As a result, to link a Tor 
user to a destination, it suffices to observe the entry and the exit relays of a circuit. 
Standard security analysis of Tor [11, 21] shows, therefore, that if t is the fraction of 
relays that are observed an adversary will be able to violate anonymity on t^ of all of the 
circuits. Note that, due to bandwidth-weighted path selection in Tor, t is best thought 
of as the fraction of total Tor bandwidth that belongs to relays under observation' . The 
security of Tor, therefore, relies on the assumption that a typical adversary will not be 
able to observe a significant fraction of Tor relays. For most adversaries, the easiest way 
to observe relay traffic is to run their own relays or compromise existing ones. Given 
that Tor (in 2012) consists of over 2500 relays with an aggregate bandwidth of over 
12Gbps [6], it is reasonable to assume that for most adversaries t will remain small. 



2.2 Selective Denial of Service in Tor 

An adversary who controls a Tor relay can perform a number of active attacks to in- 
crease the odds of compromise [7, 8]. One approach, which is the focus of this work, 
is selective denial of service [8]. A compromised relay that participates in a circuit can 
check whether this is one that it is able to compromise, i.e., whether the entry and exit 
relays are both under observation. If this is not the case, the relay can "break" the circuit 
by refusing to forward traffic. This will cause a user to reformulate a new circuit for the 
connection, giving the adversary another chance to compromise the circuit. A simple 
analysis shows that this increases the overall fraction of compromised circuits to: 

> i' (1) 



t2 + (1 - i)3 

because only circuits with compromised entry and exit relays (i^) or circuits with no 
compromised relays ((1 — i)^) will be functional, and out of those t^ will be compro- 
mised. E.g., if t = 0.2, selective-DoS increases the fraction of compromised circuits 
from 4% to 7.25%. 

The use of guard nodes changes the analysis somewhat. If none of a user's guards 
are compromised, that user is effectively immune from selective-DoS, since they will 
never use a compromised entry relay regardless of the attack.^ If, on the other hand, 
one or more of the guard relays are dishonest, the user is significantly impacted, as the 
dishonest guard(s), chosen for a significant fraction of all circuits, will break any circuits 
that do not use a compromised exit. Therefore, guard nodes mitigate the selective-DoS 
attack in that it will affect fewer users, but amplifies its effects for those users who are 
unlucky enough to choose dishonest guards. 



' To be more precise, the correct fraction would be tg ■ ie, where tg and ie are the fractions of 
the guard and exit bandwidth under observation, respectively. For simplicity of presentation, 
we will assume tg = t^ — tm = t in the rest of the paper. 

^ We assume that an adversary cannot observe any honest relays. 



3 Our Detection Algorithm 

Our goal is to construct a local detection algorithm that can be utilized by a Tor user 
to safeguard him or herself against selective-DoS attacks. We propose a probing algo- 
rithm that aims to identify compromised circuits. In this section we will first give an 
overview of our detection algorithm and then discuss in details the different phases of 
the algorithm. 

3.1 Overview of Our Algorithm 

Our algorithm is built on the assumption that a relatively small fraction of all relays are 
compromised. As discussed previously, this is a key assumption underlying the over- 
all Tor security model. The algorithm works in two phases and runs periodically every 
one hour In the first phase, we construct random circuits following the Tor path con- 
struction algorithm and then test their functionality. Under selective-DoS attack, we 
expect only two types of circuits to work: honest circuits that contain no malicious re- 
lays, and compromised circuits with a compromised entry and exit relays. According 
to our assumption, the number of honest circuits formed is significantly more than that 
of compromised circuits. In the second phase, we cross-check the circuits against each 
other by changing their exit relays. The prevalence of honest circuits means that com- 
promised circuits will encounter more failures in the second phase than honest ones and 
therefore can be eliminated. Table 1 summarizes the different parameters used for our 
detection algorithm. 

Table 1. Parameters Used 



Setting 


Parameter 


Description 


Environmental 


t 


Fraction of routers compromised 


g 


Fraction of compromised guards per user 


f 


Random network failure 


d 


Random drop rate by compromised nodes 


Tunable 


N 


# of working Tor circuits created in 1st phase 


K 


# of probes used per circuit in the 2nd phase 


Th 


Threshold for classifying circuit 



3.2 First Phase 

Tor circuits live for 10 minutes meaning that we need at most 6 non-compromised cir- 
cuits every hour. So in the first phase of our detection algorithm we iteratively generate 
a random Tor circuit, (according to the Tor path specification [10]) and test its function- 
ality by retrieving a web file through the circuit. If it fails we discard the circuit and try 
a new circuit. We stop when we have N (in section 4.4 we will show how to calculate 
the value of N) working circuits. 

If an adversary is carrying out selective-DoS attack then after the first phase we 
should have a set of circuits that have the form of either CXC or HHH, where C denotes 
a compromised relay, H denotes an honest one, and X is a relay of any type. Note 
that some circuits of the above forms may still fail for "natural" reasons, such as an 
overloaded relay. We will discuss the impact of such failures in our analysis. 



3.3 Second Phase 

In the second phase, we examine each of the circuits from the first phase (we will call 
these circuits as potential circuits) by cross-checking them with each other. We evaluate 
each potential circuit as follows: 

• We randomly pick K{1 < K < N) other circuits (we will call them as candidate 
circuits) out of the list of potential circuits. 

• For each of the K candidate circuits, we change the exit relay of the potential 
circuit being evaluated with the exit relay of the candidate circuit (a schematic 
description is shown in Figure 1).^ We then test the functionality/reliability of the 
new circuit by performing a test retrieval through it. If, out of these K probes, 
Th or more succeed, we consider the evaluated circuit to be honest; otherwise, we 
consider it to be compromised. 

Note that under selective-DoS, if we change the exit relay of a compromised circuit 
with that of an honest circuit, we will get a circuit where the entry is compromised and 
the exit is honest and hence the file retrieval will fail. On the other hand, if the evaluated 
and candidate circuits are both honest, or both compromised, the probe will succeed. 
We expect more successes for an honest circuit, since most of the potential circuits are 
honest; we use Th as a threshold for distinguishing between the two circuit types. 

At the end of second phase, we will have some number of potentially honest circuits. 
This collection of circuits is then used for making real anonymous connections. Once 
the pool of circuits is exhausted (typically after one hour if used continuously), the 
algorithm is run again to identify new honest circuits. (Ideally, the algorithm would be 
started ahead of time to avoid a delay in circuit availability.) The pseudo-code of our 
detection algorithm is given in Algorithm 1 . 
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C X H 3»- Circuit liilled 

HHC 3»- Circuit killed 

cxc =a- Circuit not killed 

HHH 9^ Circuit not killed 



C: compromised router 

H: non-compromised router 

X: either type of router 



Fig. 1. Modifying the of exit relay of the evaluatee with that of the candidate circuit to generate 
a probing circuit in the second phase. 



4 Security Analysis 

In this section we will analysis the various security aspects of our detection algorithm 
through a probabilistic model. 



^ Tor circuits have to follow the constraint that no two relays in the same circuit can be within 
the same /1 6 network, or part of the same operator-specified family. Therefore, when choosing 
the K candidate circuits, we pick only those whose exit nodes would not violate this constraint 
when used with the evaluated circuit's entry and middle. 



Algorithm 1 Generating secured Tor circuits 



Input: List of stable, valid and running Tor routers. Parameters N, K and Th 

Output: List of usable Tor circuits 

1st Phase: 

i-(- 1 

while i < A'^ do 

Create a random Tor circuit according to Tor path specification 

Probe the Tor circuits to check its reliability 

if probing successful then 
i ^ i + l 

end if 
end while 

Consider the set of circuits that pass this phase as P 
2nd Phase: 

for each x £ P Ao 

Choose K other circuits from P such that they do not violate Tor path constraints 

count <— 

for each y £ K do 

Modify the exit relay of x with that of y 

Probe the modified circuit 

if probing successful then 
count <— count + 1 

end if 
end for 
if count > Th then 

Classify x as honest circuit 

s ^ sux 

else 

Classify x as compromised circuit 
end if 
end for 
return S 



4.1 Considering Compromised Guard Nodes 



The selective-DoS attack is particularly troubling due to the predecessor attack [23]. To 
resist the predecessor attack, Tor introduced a defensive mechanism where each user 
picks a small fixed set of guard nodes (usually 3) that are always used as the first node 
in a circuit [22]. As a result, users who pick honest guard nodes will be immune to 
the predecessor attack. Guard nodes similarly help defend against selective-DoS where 
users with honest guards will never have their anonymity compromised. However, in 
another way, if certain fraction of the guard nodes are compromised it can actually 
make the selective-DoS attack more powerful. Assume a user has G (typically G ~ 3) 
guard nodes where g fraction of them are compromised. So g G {0, 0.33.0.67, 1} for 
different number of compromised guard nodes. 



4.2 False Error Rates 

We will first analysis the false-negative and false-positive rates of our algorithm under 
selective-DoS strategy. For now we assume that the adversary terminates any circuit 
which it cannot compromise; we consider other approaches in Section 4.5. 

We consider an adversary who compromises a bandwidth-weighted fraction t of 
all Tor relays. First, we will calculate false-negative rate-the fraction of compromised 
circuits that pass our detection algorithm. The probability of FN depends upon the 
number of compromised ( CXC) and honest (HHH) circuits randomly created in the 
first phase. Let, m and h represent the number of circuits of the form CXC and HHH 
respectively. Then probability of false negative error can be calculated by the following 
function: 

N 



Pt{FN) ^ Y^ Pr(C == c) Pt{FN\C = c) 

c=0 

N N-c 

= Y^ Pr(C = c)Y P^CiJ = h\C = c) Pt{FN\H = h,C ^ c) (2) 



c=0 /i=0 



where C and H are the numbers of compromised and honest circuits after phase 1, 
respectively. Note that, likewise, for false-positive errors (fraction of honest circuits 
falsely discarded): 



N N-c 



Pr(FF) = Y P^C*^ ^ ^) XI P^(^ = ^^'^ = ^) ■ P^iFP\H ^ h,C ^ c) (3) 

c=0 /i=0 

To calculate the individual probabilities in (2), we can approximate C by the Bi- 
nomial distribution B{N,gt) and H\C = c by the Binomial distribution B{N — 

c, ~i_ 7 )• "^^^^ calculation assumes that relays are sampled with replacement and 
that family and /1 6 subnet constraints are ignored, but given the large number of Tor 
relays, this results in minimal approximation error 

A false-negative error occurs when a malicious compromised circuit is paired with 
at least Th other compromised candidate circuits. Since these circuits are sampled with- 
out replacement, we can calculate Pr(FA^|C ^ c, H = h) using the hypergeometric 
distribution: 

K' /c-lW h \ 

P,{FN\C ^c,H = h)=Y Hrfef^ (4) 

i=Th' V K' I 

where K' = m:in{K, c + /i - 1) and Th' = min(T/i, K'). 

Similarly, a false-positive error occurs when an honest evaluated circuit is paired 
with fewer than Th honest candidate circuits: 



Pr{FP\C = c,H = h)=Y Hrfe^ (5) 

i=0 \ K' I 



4.3 Dealing with Transient Network Failures 

Regardless of whether selective-DoS is being performed or not, circuit failures can and 
will happen in Tor This may be caused by connectivity errors in the network, or, more 
likely, congestion at or crash of the Tor relay. In any network infrastructure there is 
always some network failure. Since, network failure can directly influence the success 
rate of our probing, it can affect both FN and FP. So equation (2) needs to be updated. 
In the first phase we have to consider that a fraction of both CXC and HHH circuits 
fail. Lets assume that out of the C, CXC and H, HHH circuits, C" and H' respectively 
survive random network failure. Then we have: 



N 



Pt{FN) = Y^ Pr(C = c) 

c=0 

N 

= ^Pr(C = c) 



Y^ Pr(C" = c'\C = c) Pt{FN\C' = c',C = c) 



c=0 
h 



^Pr(C' = c'|C = 



Lc'=0 



'N-c 



J2 Pr(^ = h\C = 



L/i=o 



J2 Pi-(^' = h'\H = h) Pi{FN\C = c,C' = c', H = h,H' = h') 



h'=0 



Here Pr(C" = c'\C = c) and Pr(_ff = h'\H = h) are defined as given below: 

pr(c' = c'\c = c) = B{c, c', 1 - /) = f "^ Vi - rr'r-^' 



Vv{H' = h'\H = h)= B{h, h', 1 -./)=,, (1 - fr f 



h> 



\h' j^h — h' 



(6) 

(7) 
(8) 



Here the term B(c,c' ,1 — /) represents a binomial distribution, i.e., we are selecting 
c' element from total c elements with probability 1 — /. Considering random network 
failure we have c' compromised and h' honest circuits after the first phase. We also have 
to consider failures in the second phase, where certain fraction of the modified circuits 
will fail to retrieve a file through the network. This will cause equation (4) and (5) to be 
modified as follows: 



FTiFN\C' = c',H' = h')= Y ^\l'}!:^-i\^ E B{^,J,l-.f) 

J=Th' 



Z^ (c'+h'-l\ 

i=Th' \ K' ) 



(9) 



Pr(FF|C' = c',H' = h') = l-Y ^ (2h^-i~? il B{t,j,l- f) (10) 

i=Th' \ K' ) j=Th' 

where K' = viiin{K, c' + h' -I) and Th' = min(r/i, K'). (Note that phase 2 depends 
only on C" and H' and is conditionally independent of C and H.) 



4.4 Tuning Parameters 

Probabilistic Bounding: Our detection algorithm has three tunable parameters ( A^, K, Th) 
(see Table 1 for description). We will use probabilistic expectation analysis to determine 



what values (or ranges) to use for them. By default, Tor creates a new circuit every 10 
minutes and since our algorithm is rerun every one hour, 6 honest circuits are required 
by a user in an one hour period. So we can calculate the value of N from this condition 
as follows: 



2 



6 = N X 



N = 



6 X 



(l-.g)(l-0 
.gt+(l-.g)(l-t)2 

gt+{l-g){l-tf 

ii-g){i-tr 



(11) 



So N varies as g varies. For g = I, N tends to infinity which is understandable because 
with all guards being compromised a user can never construct an honest circuit. In other 
words, if all the guards are compromised it's pointless to use any filtering technique. 

Now, lets look at how to set the value of parameters K and Th. For concreteness, 
we will consider t — 0.2, as smaller values diminish the impact of selective-DoS, and 
larger values will violate our assumption about most of the Tor relays being honest. In 
the presence of selective-DoS, the expected number of honest and compromised circuits 
passing the first phase of our detection algorithm are: H = N x ^_i_n_ ■)n_f)2 and 
C = N X t^dJXd^ty^ respectively. For t = 0.2,C<H except forg = 1. So, from 
anhonestcircuit'spointofviewif we were to choose iiT = to- C (where m G 5R,to, > 0) 
probes in the 2nd phase then in the worst case we would have C out of the K candidate 
circuits of form CXC . In order to have at least 50% of the probes to be successful, the 
following condition must be met: 

2C <m-C <N 
^2<TO<l + ii^^Kl^ (12) 

Now, the best possible outcome that a compromised circuit can achieve is: C — 1 suc- 
cessful probes out of K probes. On the other hand, the worst possible outcome for 
an honest circuit is {m — 1)C successful probes out of K probes. With M > 2, it 
is clear that (to — 1)C > C. The value of Th should, therefore, lie in the range of 
(to — 1)C < Th < K. Thus, given the value of t, g and N we can determine the range 
of K and Th to ensure with high probability that compromised circuits are filtered out. 
In Appendix A we show how we can possibly tune K and Th based on the crossover 
point of FN and FP. 

Security vs Overhead: In this section we introduce two evaluation metrics: security 
(ip) and overhead (rj). We then tune K and Th in terms of these evaluation metrics. 
We define security as the probability of not choosing a compromised circuit for actual 
usage and overhead as the measure of bandwidth overhead required by each user in 
conducting probes. 

V; = 1 - Pr(i^iV) (13) 

Nx?,xSx{l + K) 
ri = ^ (14) 



where S represents a single probe size and T represents the frequency (in seconds) 
at which our algorithm is repeated. Note that it is important that compromised relays 
should not be able to distinguish between probes and real requests. Since compromised 
exit relays can see the request destination, we cannot use a fixed collection of download 
locations for the probes. Instead, we propose downloading popular web pages [2]. This 
will make it harder for compromised exits to distinguish probes from actual traffic. 
According to Google the average size of the top sites on the Internet is around 300KB 
[20]. So, we set S = 300KB and since our algorithm is rerun every one hour we set 
T = 3600 seconds. We use these values to evaluate rj. Figure 2, shows the distribution 
of {K, Th) for different values of if) and -q. We can see that as K increases the overhead 
per user also increases, so we would typically want to keep the value of K as small 
as possible while still achieving reasonable security. Figure 2 also highlights the fact 
that as g increases the security metric "0 decreases. This is understandable because as 
more and more guards become compromised the probability of choosing compromised 
circuits also increases. From figure 2 we see that values such as {K, Th) = (3, 2) 
achieves acceptable outcomes in terms of both security and overhead. 
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Fig. 2. Tuning parameters {K, Th) against security metric tp and communication overhead r; 
for different fraction of compromised guards (per user). Results for g = 0.33, 0.67 are more 
interesting than the results for g = 0, 1 as they are trivial. 



4.5 Analyzing Other Attack Strategies 

So far we have assumed that the adversary is doing selective-DoS, i.e., dropping any 
communication which it cannot compromise. However, it is possible for the adversary 



(16) 



to do probabilistic dropping, where a compromised router terminates a certain fraction 
of all circuits that it cannot compromise. Doing so could potentially increase an ad- 
versaries chance of passing the second phase. Lets analyze how probabilistic dropping 
could help an adversary with our detection algorithm deployed. Any circuit formation 
must belong to the set {HHH, HHC, HCH, CHH, CCH, CHC, HCC, CCC}. Now 
circuits of forms {HHH, CHC, CCC} are never terminated (ignoring network fail- 
ure), but under selective-DoS all other forms of circuits are always dropped. However, if 
the adversary was not to kill any circuit then all forms of circuits would survive the first 
phase and a compromised circuit would have a wider variety of circuits to chose from in 
the second phase. Any circuit belonging to the set {HHC, CHC, CCC, HCC} would 
benefit a compromised circuit in the second phase. If selective-DoS attack is being per- 
formed then from a compromised circuit's point of view the probability of selecting 
another circuit with compromised exit router is: 

il (15) 

On the other hand with d% drop rate this probability becomes: 

t^ + [{1 - g){l - t)t + (1 - g)P]{l - d) 
(1 - .9)(1 - t)2 + gt + [1 - (1 - .g)(l - tr - gt]il - d) 

A seemingly better strategy against our detection algorithm would be to allow all cir- 
cuits belonging to the set {HHC, CHC, CCC, HCC} to always go through and drop 
other forms of circuits at rate d. We will call this strategy as shrewd strategy for fu- 
ture reference. For the shrewd strategy the probability of selecting a candidate with 
compromised exit router becomes: 

t 
{l-g){l-t)^+t+[l-{l-g){l-tY-t]{l-d) ^^^^ 

Figure 3 highlights the above calculated probabilities for different drop rates. As 
we can see from figure 3, at higher drop rate the probability of success in the sec- 
ond phase is significantly higher for the shrewd strategy compared to the simple strat- 
egy. In any case, through probabilistic dropping an adversary can increase its chance 
of bypassing our detection algorithm; however that comes at the cost of forwarding 
large fraction of the traffic through non-compromised circuits (circuits belonging to the 
set {HHC, HCH, CHH, CCH, HCC} are termed as non-compromised). Figure 4 
shows the fraction of non-compromised circuits used in forwarding traffic. We see from 
figure 4 that compared to simple strategy, shrewd strategy forwards more traffic through 
non-compromised circuits. So the shrewd strategy seems to have nominal benefit. 

Detecting Probes: An efficient attacker could also distinguish between probes from 
actual user traffic and adopt the following strategy to remain undetected. The attacker 
always let probes go through and launch selective-DoS on actual traffic. However, since 
we are using popular web sites as probing destinations, it would make it difficult for an 
adversary to distinguish probes from actual traffic '*. Moreover, we can strengthen our 



** One could also setup exit relays and collect information about the common web sites visited 
by users. These web sites can then be used for creating probes. 
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Fig. 3. Probability of selecting candidate circuits (in the second phase) with compromised exit 
relay for different drop rate d. Shrewd strategy seems to be a better choice for an adversary. 
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Fig. 4. Fraction of non-compromised circuits tiiat forward trafiic under botli strategies for differ- 
ent drop rate d. Shrewd strategy seems to be more costly than the simple strategy for an adversary. 



approach by increasing the number of probes per circuit. We can then probe the given 
circuit at random points of the circuit's life span. We can probabilistically show that this 
approach makes it really hard for an adversary to avoid detection. 

Lets assume that we randomly (from a uniform distribution) select m unique points 
from a circuit's life span L (by default L = 10 minutes) to probe the circuit. Lets 
represent these points as {xi, a;2, ..., x^}. Suppose compromised nodes randomly se- 
lect D as the time to perform selective-DoS. Now the adversary succeeds in carrying 
out selective-DoS only when D > max^^i 2 m{xi}- Probability of such success- 
ful selective-DoS (assuming the random points are selected independently) is given as 
follows: 



Pr(sMCcess) — Pr( max {xi} < D) 

i— l,2,...,m 

= Pr(xi < D) ■ Vt{x2 < D) ■ ... ■ Pr(x™ < D) 

D D D 

f{X = xi)dx ■ / f{X = X2)dx ■ ... ■ / f{X ^ Xm)dx 
00 



(18) 



So Pr(success) — > 1 if I? — > L which means that the more late the selective-DoS is 
launched the more chance it has in succeeding. But this itself is self-defeating because 
it means that the adversary has to forward a significant amount of traffic through non- 
compromised circuits ^ . 



Total circuit duration= L 
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Fig. 5. Randomly probing circuits at different points of their life span. Probabilistically it becomes 
harder for an adversary to remain non-detected as it cannot predict when to break circuits. 



5 Experimental Evaluation 

5.1 Simulation Results 

We implemented a simulator in C-n- that emulates the basic functionality of Tor circuit 
construction and selective-DoS attack. We collected real Tor node information from [6] 
and randomly tagged 20% {t — 0.2) of the bandwidth to be controlled by a compro- 
mised entity. For most of the simulations we set / = 0.23 (details for setting such rate is 
discussed in Appendix B). Here Tor circuits were created following the Tor path speci- 
fication [10]. We vary g {0 < g < 1) and d (0 < d < 1) to analyze the robustness and 
effectiveness of our detection algorithm. Here, 100% drop rate refers to selective-DoS 
and 0% drop means no dropping at all. In the following evaluations we give more em- 
phasis to g = 0.33, 0.67 (i.e., 1 or 2 of the 3 guards is/are compromised), since g = 0, 1 
are trivial scenarios. All simulation results are averaged over 500 runs. 



Robustness: First, we will look at the robustness of our detection algorithm in filtering 

out compromised circuits. For this we evaluate the security metric, tjj (see equation 13) 
of our algorithm. We set K — 3, Th — 2 (see section 4.4 for more details). We also 
explored the impact of other parametric choices in Appendix C. Figure 6 highlights 
the evaluated security metric, tp. As evident from the figure when the adversary moves 
from no dropping to more aggressive dropping (i.e., moving towards selective-DoS) ip 
increases which signifies the effectiveness of our algorithm in securing honest circuits 
for users. The main reason behind the increase in tp lies on the fact that as compromised 



^ Note that this could potentially increase the overhead, but we could choose smaller size web 
sites (among the popular sites) to compensate for the increased overhead 



nodes start to perform aggressive dropping, the pool of available circuits after the first 
phase quickly converges to the set {CXC, HHH}. This in turn lowers a compromised 
circuit's chance of selecting other compromised candidate circuits in the second phase 
of our detection algorithm as HHH dominates over CXC for t = 0.2. Figure 6 also 
highlights the security guarantees provided by the conventional Tor network (dashed 
lines). So from the figure we can infer that our detection algorithm provides higher 
level of security assurance compared to the conventional Tor network. Increasing the 
number of probes helps to achieve even better results as discussed in Appendix C. But 
that comes at the price of higher bandwidth overhead. 
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Fig. 6. Average security (in terms of not selecting a compromised circuit) for different drop rates 
d. Our approach achieves a better security guarantee when compromised nodes start to carry out 
aggressive dropping. 



Cost Analysis: We also analyze the amount of overhead introduced by our scheme. 
This is affected by two factors: probe size and the number of probes considered during 
the second phase, K (see equation 14). Note that reducing K will directly reduce the 
number of probes, but, as shown in Figure 2, lower values of K lower the security 
guarantee, ip. We estimated rj from simulations for varying choices of K and we found 
that the former effect dominates: lower values of K improve overall overhead (shown 
in figure 2). Th does not affect the number of probes, but higher values of Th increase 
the security guarantee of the detection algorithm. 

Lets consider the worst case scenario where a large number of Tor users run our 
algorithm simultaneously. Tor is estimated to have roughly (overestimate) 100,000 si- 
multaneous users [15] and the average total relay-bandwidth provided by Tor during 
the first 10 days of April, 2012 was found to be 1,733,164 KB/s [4]. From these infor- 
mation we can calculate the fraction of bandwidth required by our detection algorithm. 
For example, for a probe size of 200KB and K = 3, our algorithm would require a 
total of 6>'3x200x(i+3) ^ i^gOOOO = 400, OOOKB/s or 23% of the total bandwidth. Note 
that this is most likely an overestimate because its hard to think that all 100,000 users 
will start running our algorithm exactly at the same time. Nevertheless this cost can be 
reduced by lowering the individual probe size (potentially we could use smaller size, 
popular web pages as probes). 



5.2 Real World Experiment 

We carried out our experiment by introducing our own relays into the Tor network, all of 
which acted as compromised nodes. For this purpose we used 1 1 Emulab [1] machines, 
10 of which were configured to act as Tor relays with a minimum bandwidth capacity of 
20Kbps. Note that all our nodes belonged to the same /16 subnet, meaning that no user 
would (by default) choose two of our nodes in the same circuit. Moreover, to prevent 
other users from using our nodes as exit nodes, we configured our relays with a fixed 
exit policy (allowing connection to only specific destinations). All these measures were 
taken to reduce the non-benevolent impact of our relays on the Tor network. 

For implementing selective-DoS we take an approach similar to the one described 
by Bauer et al. [7]. Here, out of the 1 1 machines we run Tor protocol on 10 of them and 
used the remaining machine as a server for gathering timing information about which 
router is communicating with whom at what time. The sever performs timing analysis 
and informs the other 10 machines when to drop communication to perform selective- 
DoS (we modified the latest version of Tor source code tor-0.2.2.35). We implemented 
our detection algorithm in the client side in Python (we used the open source Python 
library of Tor Control Port (TorCtl.py)^})]). 

In our experiments we first query the Tor directory server to retrieve a list of all 
available Tor routers and then filter this list by considering only those routers which 
are flagged as running, stable and valid, because we want our routers to be alive and 
running during our experiments. We selected 40 Tor nodes (3 guards, 19 exits and 18 
relays) at random with probability proportional to their bandwidth and added our own 
10 nodes to this set to get a total of 50 nodes. This choice results in about 20% of the 
nodes being compromised. To emulate user traffic/usage, we retrieve a random web file 
100-300 KB in size. Table 2 summarizes our findings. 

Table 2. Experimental results from the real Tor network 
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From table 2 we see that as g increases the security assurance provided by both our 
approach and the conventional Tor network go down. However, for g = 0.33, 0.67 our 
approach shows significant improvement in filtering out compromised circuits. Thus we 
can say that our detection algorithm provides strong robustness even when two guards 
out of the three guard nodes are compromised. 

6 Related Work 



Securing Tor circuits under selective-DoS is relatively a new research topic. Borisov 
et al. [8] first showed that carrying out selective-DoS could benefit an adversary to in- 
crease its chance of compromising anonymity for both high and low-latency anonymous 



communication systems like Hydra-Onion [13], Cashmere [25] and Salsa [16]. In fact, 
it was pointed out that with 20% compromised nodes in Salsa, the selective-DoS attack 
results in 19.14% compromised tunnels compared to the conventional security analysis 
of 6.82% compromised tunnels. 

Later on Banner et al. [9] proposed a detection algorithm for selective-DoS attack 
on Tor Their algorithm basically probes each individual Tor node in the network and 
they prove that this requires 0{n) probes to detect all compromised nodes in the Tor 
network comprising of n participants. For Tor circuits of length 3 their algorithm re- 
quires 3n probes; however to handle transient network failures they proposed to repeat 
each probe I number of times. They define an lower bound of I; under conventional 
analysis a value of 10 for / was shown to be sufficient. So this means for a Tor network 
with 2500 nodes, it would require roughly 3 x 2500 x 10 = 75, 000 probes to identify 
all compromised nodes in the network. However, their algorithm assumes that compro- 
mised nodes have a fixed characteristic of always dropping non-compromised circuits. 
They do not consider complex attack strategies whether compromised nodes may per- 
form random dropping. Moreover, they provide no analysis of the overhead involved 
in performing these probes. Clearly, this approach will not scale well if a large number 
of users start to probe Tor nodes simultaneously. We take a different approach where a 
user tries to accumulate a set of non-compromised working circuits (for future usage) 
instead of classify all Tor nodes as either compromised or non-compromised. We also 
analysis different types of complex attack strategies against our detection algorithm. 

7 Conclusion 

Anonymous communication systems like Tor are vulnerable to attacks like selective 
denial of service which considerably lowers anonymity. Such attacks however, can be 
detected through probing. Our detection algorithm probes Tor circuits to filter out po- 
tentially compromised circuits with high probability. We have also highlighted the fact 
that an adversary can choose to deny service probabilistically to avoid detection and 
increase its chance of compromising anonymity. But such strategy comes at the cost 
of forwarding traffic through many non-compromised circuits which is self-defeating. 
Our experimental results demonstrate that our detection algorithm can effectively de- 
fend users against selective-DoS attack. 
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Appendix 

A Tuning K and Th using crossover points between FN and FP 

Parameter Th impacts both FN and FP rating for a given K value. If we increase 
Th (for a given K) it lowers FN while it increases FP. Figure 7(a) shows the prob- 
ability of FN and FP against threshold Th for the parameter setting {t,g,f,d) = 
(0.2, 0.33, 0.23, 1) with K = 10. The y-axis is given in log-scale. As we can see from 
the figure the FN and FP crossover and this crossover point can be used to determine 
the value of Th to use. In this case (for K = 10), we see that Th can be set to either 5 
or 6 (which conforms with the range of 1 < Th < K, computed from section 4.4). We 
can then use this crossover points to compute the pair [K^ Th). Figure 7(b) also shows 
the corresponding values of K and Th at the crossover points. This can be used to tune 
the value of K and Th. 

B Approximating Failure Rate in the Tor Network 

To approximate the failure rate present in the current Tor network we take the help 
of the TorFlow project [5]. TorFlow project measures the performance of Tor network 
by creating Tor circuits and recording statistical data such as circuit construction time, 
circuit failure rates and stream failure rate. We are interested in the circuit failure rate 
as it directly impacts the false ratings of our detection algorithm. So for our purpose 
we run the buildtime.py [5] python script to generate 10,000 Tor circuits and record 
their failure rate. We ran the script 10 times and found the average failure rate to be 
approximately 23%. We therefore set / — 0.23 in our simulations. 

C Exploring the Impact of Parameter choices for K, Th 

Here we will explore the impact of K and Th on our evaluation metrics: ij) and 77. As 
stated before K directly impact 77 (in fact 77 linearly increases with K) and Th directly 
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Fig. 7. (a) Computing the value of Th at wliich FN and FP crossover, (b) Using this crossover 
point we can determine the value of Th for a given K. 



impacts tp (as we increase Th, FN decreases which in turn improves tp). We therefore 
run our simulation for different pairs of {K, Th). Figures 8(a)-8(c) highhght three such 
outcomes. We can see from the figure that as the pair {K, Th) increases the security 
metric ^ also improves. However, as K increases rj also increases (see equation 14). 
Thus, there exists a tradeoff between security and bandwidth overhead. 
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(b) Security metric ip for K = 5, Th = 4 
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Fig. 8. Average security (in terms of not selecting a compromised circuit) for different drop rates 
d. As we increase K the security metric t/j improves but the overhead metric 77 (hnear function of 
K) increases. 



